https://community.splunk.com/t5/Splunk-Enterprise/LDAP-groups-do-not-get-replicated-between-search-heads-in-a/m-p/520661#M3500 <P>Hi, Rony here.<BR /><BR />We've got a Search Head Cluster with 6 Search Heads.<BR />When a user access our splunk URL, it hits a load balancer, wich randomly uses one of the 6 Search heads.<BR />Authentication is by LDAP integration.<BR />&nbsp;</P><P>Heres the problem:<BR />When a user logins to splunk, that user groups (and as a result, his roles) only gets updated on the specific search head that user happens to hit.<BR />If the user continues to use splunk, the load balancer might connect him to another search head, where the user groups are not updated<BR />The user tries to perform an action that requires the permissions provided by the group, and fails.<BR /><BR />Is there a way that, when the user logs in, his assigned LDAP groups gets replicated to all the search heads on the cluster?<BR /><BR /></P> Mon, 21 Sep 2020 16:05:54 GMT tqi_raurora 2020-09-21T16:05:54Z https://community.splunk.com/t5/Splunk-Enterprise/LDAP-groups-do-not-get-replicated-between-search-heads-in-a/m-p/520661#M3500 <P>Hi, Rony here.<BR /><BR />We've got a Search Head Cluster with 6 Search Heads.<BR />When a user access our splunk URL, it hits a load balancer, wich randomly uses one of the 6 Search heads.<BR />Authentication is by LDAP integration.<BR />&nbsp;</P><P>Heres the problem:<BR />When a user logins to splunk, that user groups (and as a result, his roles) only gets updated on the specific search head that user happens to hit.<BR />If the user continues to use splunk, the load balancer might connect him to another search head, where the user groups are not updated<BR />The user tries to perform an action that requires the permissions provided by the group, and fails.<BR /><BR />Is there a way that, when the user logs in, his assigned LDAP groups gets replicated to all the search heads on the cluster?<BR /><BR /></P> Mon, 21 Sep 2020 16:05:54 GMT https://community.splunk.com/t5/Splunk-Enterprise/LDAP-groups-do-not-get-replicated-between-search-heads-in-a/m-p/520661#M3500 tqi_raurora 2020-09-21T16:05:54Z https://community.splunk.com/t5/Splunk-Enterprise/LDAP-groups-do-not-get-replicated-between-search-heads-in-a/m-p/520761#M3537 <P>How did you update LDAP configurations on search heads are in cluster?</P><P>Did you update LDAP groups from Search head CLI? if you have updated from search web, ideally this should get replicated to all search members part of cluster.</P><P>and also, once you make change from splunk search member GUI, verify the change in another search member.&nbsp;</P> Tue, 22 Sep 2020 09:03:09 GMT https://community.splunk.com/t5/Splunk-Enterprise/LDAP-groups-do-not-get-replicated-between-search-heads-in-a/m-p/520761#M3537 thambisetty 2020-09-22T09:03:09Z